CVE-2015-4356: Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-...

Security readout for executives and security teams

CVE-2015-4356 is an authenticated cross-site scripting issue in Drupal's contributed Webform module. A user with specific Webform permissions could submit content that later runs script or HTML in a view-based results table. The main risk is session abuse or administrative action through a trusted browser. Exposure is most likely on Drupal 7 sites using the Webform contributed module version 7.x-4.x before 7.x-4.4, especially where non-admin users can submit webforms and view or influence results displays. Treat as a scheduled remediation item unless the site exposes Webform privileges to many users or handles sensitive sessions. Prioritize faster if administrators review webform results in the same environment. Mitigation focus: Upgrade Drupal Webform module to 7.x-4.4 or later.; Check current Drupal.org advisory guidance before changing production systems.; Restrict Webform-related permissions to trusted roles until upgraded..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.